2017-04-04 18:26:39 -04:00
|
|
|
[[ml-get-record]]
|
2017-04-11 21:52:47 -04:00
|
|
|
//lcawley Verified example output 2017-04-11
|
2017-04-10 19:14:26 -04:00
|
|
|
==== Get Records
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-11 21:52:47 -04:00
|
|
|
The get records API enables you to retrieve anomaly records for a job.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
|
|
|
===== Request
|
|
|
|
|
|
|
|
`GET _xpack/ml/anomaly_detectors/<job_id>/results/records`
|
|
|
|
|
2017-04-18 18:13:21 -04:00
|
|
|
|
2017-04-04 18:26:39 -04:00
|
|
|
===== Description
|
|
|
|
|
2017-04-18 18:13:21 -04:00
|
|
|
You must have `monitor_ml`, `monitor`, `manage_ml`, or `manage` cluster
|
2017-04-20 11:45:30 -04:00
|
|
|
privileges to use this API. You also need `read` index privilege on the index
|
|
|
|
that stores the results. The `machine_learning_admin` and `machine_learning_user`
|
|
|
|
roles provide these privileges. For more information, see
|
|
|
|
<<security-privileges>> and <<built-in-roles>>.
|
2017-04-18 18:13:21 -04:00
|
|
|
|
2017-04-04 18:26:39 -04:00
|
|
|
===== Path Parameters
|
|
|
|
|
|
|
|
`job_id`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(string) Identifier for the job.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
===== Request Body
|
|
|
|
|
|
|
|
`desc`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(boolean) If true, the results are sorted in descending order.
|
2017-04-10 19:14:26 -04:00
|
|
|
|
|
|
|
`end`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(string) Returns records with timestamps earlier than this time.
|
2017-04-10 19:14:26 -04:00
|
|
|
|
|
|
|
`from`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(integer) Skips the specified number of records.
|
2017-04-10 19:14:26 -04:00
|
|
|
|
|
|
|
`include_interim`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(boolean) If true, the output includes interim results.
|
2017-04-10 19:14:26 -04:00
|
|
|
|
|
|
|
`record_score`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(double) Returns records with anomaly scores higher than this value.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
`size`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(integer) Specifies the maximum number of records to obtain.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
`sort`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(string) Specifies the sort field for the requested records.
|
2017-04-10 19:14:26 -04:00
|
|
|
By default, the records are sorted by the `anomaly_score` value.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
`start`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(string) Returns records with timestamps after this time.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
===== Results
|
|
|
|
|
2017-04-11 16:25:38 -04:00
|
|
|
The API returns the following information:
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-11 16:25:38 -04:00
|
|
|
`records`::
|
2017-04-11 22:26:18 -04:00
|
|
|
(array) An array of record objects. For more information, see
|
2017-04-11 16:25:38 -04:00
|
|
|
<<ml-results-records,Records>>.
|
2017-04-04 18:26:39 -04:00
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
////
|
|
|
|
===== Responses
|
|
|
|
|
|
|
|
200
|
|
|
|
(EmptyResponse) The cluster has been successfully deleted
|
|
|
|
404
|
|
|
|
(BasicFailedReply) The cluster specified by {cluster_id} cannot be found (code: clusters.cluster_not_found)
|
|
|
|
412
|
|
|
|
(BasicFailedReply) The Elasticsearch cluster has not been shutdown yet (code: clusters.cluster_plan_state_error)
|
|
|
|
////
|
2017-04-04 18:26:39 -04:00
|
|
|
===== Examples
|
|
|
|
|
2017-04-10 19:14:26 -04:00
|
|
|
The following example gets bucket information for the `it-ops-kpi` job:
|
|
|
|
|
|
|
|
[source,js]
|
|
|
|
--------------------------------------------------
|
2017-04-11 21:52:47 -04:00
|
|
|
GET _xpack/ml/anomaly_detectors/it-ops-kpi/results/records
|
2017-04-10 19:14:26 -04:00
|
|
|
{
|
|
|
|
"sort": "record_score",
|
|
|
|
"desc": true,
|
2017-04-11 21:52:47 -04:00
|
|
|
"start": "1454944100000"
|
2017-04-10 19:14:26 -04:00
|
|
|
}
|
|
|
|
--------------------------------------------------
|
|
|
|
// CONSOLE
|
|
|
|
// TEST[skip:todo]
|
|
|
|
|
2017-04-11 21:52:47 -04:00
|
|
|
In this example, the API returns twelve results for the specified
|
|
|
|
time constraints:
|
2017-04-04 18:26:39 -04:00
|
|
|
----
|
|
|
|
{
|
2017-04-11 21:52:47 -04:00
|
|
|
"count": 12,
|
2017-04-10 19:14:26 -04:00
|
|
|
"records": [
|
|
|
|
{
|
2017-04-11 21:52:47 -04:00
|
|
|
"job_id": "it-ops-kpi",
|
2017-04-10 19:14:26 -04:00
|
|
|
"result_type": "record",
|
2017-04-11 21:52:47 -04:00
|
|
|
"probability": 0.00000332668,
|
|
|
|
"record_score": 72.9929,
|
|
|
|
"initial_record_score": 65.7923,
|
|
|
|
"bucket_span": 300,
|
2017-04-10 19:14:26 -04:00
|
|
|
"detector_index": 0,
|
|
|
|
"sequence_num": 1,
|
|
|
|
"is_interim": false,
|
|
|
|
"timestamp": 1454944200000,
|
2017-04-11 21:52:47 -04:00
|
|
|
"function": "low_sum",
|
|
|
|
"function_description": "sum",
|
2017-04-10 19:14:26 -04:00
|
|
|
"typical": [
|
2017-04-11 21:52:47 -04:00
|
|
|
1806.48
|
2017-04-10 19:14:26 -04:00
|
|
|
],
|
|
|
|
"actual": [
|
2017-04-11 21:52:47 -04:00
|
|
|
288
|
2017-04-10 19:14:26 -04:00
|
|
|
],
|
2017-04-11 21:52:47 -04:00
|
|
|
"field_name": "events_per_min"
|
2017-04-10 19:14:26 -04:00
|
|
|
},
|
|
|
|
...
|
2017-04-04 18:26:39 -04:00
|
|
|
]
|
|
|
|
}
|
|
|
|
----
|